What Records a Med Spa Must Keep: Tax, Sales Tax, Payroll and POS Data

Ask a med spa owner where last March's sales are and she will point at the POS. Ask where last March's outstanding package balances are and the answer is usually a report that no longer exists, because the system shows balances as of today. That gap is the whole problem with records in an aesthetics practice: the numbers that matter most live in software built to run the front desk, not to answer an auditor three years later.

This guide covers what a med spa must keep, for how long, and in what form, across federal tax, state sales tax, payroll and the POS and EMR data that only you can preserve. It is about financial and tax records. Clinical charts and consent forms have their own retention rules under HIPAA and your state medical or nursing board, and those belong to your compliance attorney, not your accountant.

Start from what each record proves

The IRS does not prescribe a filing system. Its rule is that your records must clearly show income and expenses and support what is on the return, and that the trail runs from the source document through the books to the filed form. In a med spa the source document for revenue is the POS: the ticket, the package sale, the membership draft, the gift-card load. QuickBooks Online holds the summary; the POS holds the proof. A bank statement proves money moved; it does not prove whether the $6,000 deposit was twelve neurotoxin treatments, two prepaid laser packages or a gift card for someone's mother, and those three have different tax and sales-tax consequences.

So the question for every document is: what will someone ask me to prove, and when? The IRS asks about income and deductions for three to six years. A state auditor asks about taxable retail sales and untaxed supply purchases for three or four years. A buyer asks for package and membership liability and wants to see that it ties to the POS. Payroll agencies ask about hours, commissions and classifications for up to four years.

Federal retention periods

The IRS's recordkeeping page states the periods in terms of the statute of limitations. Three years from filing is the default, but a med spa hits the exceptions more often than most businesses: the 25% omitted-income rule because card volume and cash receipts are large and easy to under-report, the property rule because lasers and body-contouring devices are depreciated over years and sold or traded in, and the employment-tax rule because payroll is the largest expense.

The clock starts when the return is filed, so a practice that extends to September 15 keeps every year's file about six months longer than one that files in March. And if a 1099-K reconciliation later shows a processor was never booked, the six-year window is the one that applies.

Sales tax records in Florida, Texas, California and New York

Retail skincare, devices and cosmetics are taxable in essentially every state with a sales tax, and a licensed practitioner is treated as the consumer of the supplies used in treatment, so a med spa is both a retailer and a use-tax payer. State record rules are stricter than federal ones in one respect: summary reports are not enough.

Florida. Section 212.13 of the Florida Statutes requires a dealer to keep a complete record of property and services sold, with invoices and gross receipts, and section 213.35 says to preserve them until the Department of Revenue's assessment window closes. Under section 95.091(3) that window is three years from the later of the return's due date or filing date, and it never closes for a period with no return filed. The Department's audit brochure puts it plainly: keep records for three years, since an audit can extend back that far, and the auditor's list includes general ledgers, sales and purchase journals, federal and state returns, depreciation schedules and exemption certificates.

Texas. The Comptroller requires sales and use tax records for at least four years, reflecting total gross receipts from all sales and taxable services, total taxable purchases, and the resale or exemption certificates behind any untaxed sale; without a certificate the sale is presumed taxable.

California. The CDTFA's Publication 116 also says four years, longer during an audit or dispute, and adds the sentence every med spa should read twice: if your point-of-sale system overwrites data in less than four years, you must transfer and maintain the data that would have been overwritten.

New York. Tax Bulletin ST-770 requires records of every sale, the amount and the tax, for at least three years from the due date, and it is explicit that daily summary or "Z" tapes are not sufficient, that each POS transaction record must contain enough detail to determine taxability on its own, and that the POS audit trail must be switched on at all times. A system that lets a manager delete or edit closed tickets without a log fails that test.

The common thread: the state wants ticket-level detail showing what was a taxable product and what was a non-taxable service. A monthly revenue total does not get you there.

The POS and EMR exports nobody else has

The IRS and the state can reconstruct your bank activity and your card volume from third parties. They cannot reconstruct your package liability, and neither can you once the system has moved on. These are the reports a med spa must export every month, because they are snapshots the software will not reproduce later:

• Outstanding package and series balances by patient as of month end, with units purchased, units redeemed and dollar value. This is the support for the deferred revenue liability on the balance sheet and the number a buyer will test in diligence.
• Membership credits and banked balances, including expired or forfeited credits and the policy under which they were forfeited.
• Gift cards outstanding, with issue date, original value and remaining value. Florida does not allow expiration dates or post-sale fees on gift certificates under section 501.95, so the liability stays on the books until redeemed.
• Sales by item with tax flag, the transaction-level detail that satisfies New York and Texas and makes a Florida audit short.
• Provider productivity and commission reports, because commission payroll is calculated from them and the IRS will want to see the tie between POS treatment revenue and the wages on Form 941.
• Tips, refunds, chargebacks and discounts, each of which explains a difference between card volume and revenue.
• Inventory counts for injectables (units on hand by product and lot) and retail (units and cost), signed by whoever counted. The dispensing log is clinical; the month-end count sheet is financial, and it is the only support for cost of goods sold.

Save each as a PDF and a spreadsheet, named by entity, report and period, in a folder that does not depend on the POS vendor's login. Our monthly close checklist lists these exports as closing steps, and the packages, memberships and gift cards guide explains how each one feeds the books.

When you switch POS systems

Changing from one platform to another is the moment practices lose years of records, because the old subscription is cancelled the week the new one goes live. Before the old system goes dark, export the full transaction history for the retention period, the final outstanding balances for packages, memberships and gift cards (which also become the opening liabilities in the new system), the gift-card register, the item and price list with tax flags, and the provider commission history. Keep read-only access for as long as the vendor allows. The POS integrations guide covers what each platform can export.

Payroll, commission and contractor support

Payroll records in a med spa have one extra layer: the commission calculation. Keep, for each pay period, the POS report the commission was computed from, the worksheet that applied the rate and any product-cost deductions, and the payroll register that shows the result, so that an auditor can walk from treatments performed to wages paid. Keep the written compensation plan each injector signed; a dispute over a product-cost deduction is a wage claim as much as a bookkeeping question. Time records for hourly staff, including hybrid hourly-plus-commission injectors, fall under the FLSA's two-year rule; the Department of Labor's Fact Sheet 21 lists the fourteen data points required for each non-exempt employee.

For contractors, the file is the W-9, the agreement, every invoice and payment, and the 1099 you filed. The medical director agreement is the most important one, because it documents the fee, the supervision duties and the business purpose of a payment the IRS otherwise sees only as a 1099-NEC to a physician. If you paid a provider you later concluded was really an employee, keep the memo that explains the reclassification. The reporting rules are in our 1099-NEC guide for med spas.

Worked example: a Florida sales tax audit, with and without records (illustrative)

Bayshore Skin and Laser (a fictional name) is an illustrative Tampa med spa with $1,500,000 of annual revenue, $270,000 of it retail skincare, run by a physician assistant owner with two RN injectors and one aesthetician. In 2026 it receives a DR-840 covering 2023 through 2025, and the auditor asks for sales journals by item, purchase invoices and three years of DR-15 returns.

On the sales side the practice is clean because it kept monthly item-level exports with tax flags: $810,000 of retail over three years, tax collected at 7.5% and remitted, every ticket traceable. The auditor's interest moves to purchases. Under Florida Rule 12A-1.020 the neurotoxin and filler invoices are exempt prescription drugs, but gloves, needles, cannulas, numbing cream, gowns and the replacement handpiece for the laser are taxable supplies, and $60,000 of them over three years came from out-of-state vendors that charged no Florida tax. Use tax at 7.5% is $4,500, plus penalty and interest. Because the invoices exist, the auditor computes the liability from actual purchases, and the practice amends its position going forward by accruing use tax monthly.

The second row is the real cost of lost records. When the practice cannot show which deposits were non-taxable services, the auditor estimates, and a sample month with a big retail promotion becomes the ratio for thirty-six months.

What usually goes wrong

The first failure is trusting the POS to be the archive. Reports are regenerated as of today, closed tickets get edited, and the subscription ends when the practice switches vendors; by the time an auditor asks for 2023, the 2023 that existed is gone. The second is keeping bank statements and calling it done. A statement proves a deposit; it does not prove that the deposit was a non-taxable neurotoxin treatment rather than a taxable retail sale, and it says nothing about the package liability the deposit created. The third is purging by a single rule: shredding everything at three years destroys the 2022 laser invoice needed when the device is sold in 2028.

The quieter failure is in the payroll file: commissions paid from a POS report nobody saved, so when the 941 wages and the W-3 disagree, or an injector disputes a deduction, there is no worksheet showing how the number was built.

When to get help

A written retention schedule, a monthly export routine and a folder structure that outlives your POS vendor are things a well-run practice can set up in an afternoon. The part that needs an accountant is making sure the exports actually tie: that the package balance report agrees with deferred revenue on the balance sheet, that the commission worksheet agrees with the payroll register, and that the item-level sales export agrees with the sales tax return. That tie-out is the heart of our med spa bookkeeping and monthly close engagement: the liability rollforward, the inventory count and the commission tie-out are closing steps every month, and the supporting exports are filed by entity and period as part of the close.

If you are switching POS platforms this year, have a DR-840 or another state's audit letter in hand, or cannot say today what your outstanding package liability was on December 31, request a 20-minute fit call. We will tell you which exports to pull before anything else disappears.

Jenny Gao, CPA, EA

Founder of Balance Partners, a CPA-led accounting, tax and fractional CFO practice for med spas. Florida-licensed CPA and IRS Enrolled Agent with more than 13 years of accounting and tax experience. Jenny writes and reviews every guide on this site. About Jenny

This guide is general educational information for owners of med spas and aesthetics practices in the United States and is not accounting, tax, legal, medical, payroll or financial advice for your situation. Rules change and vary by entity, state and facts. Balance Partners, LLC does not provide audit, review, compilation or other attest services. Last reviewed November 8, 2026.